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fat:he claim?; 

1. (currently amended) A data flow classification system comprising: 

a data flow managing mechanism configured to identify, track, and manage said data 

flow; 

a rule set including a plurality of rules for comparing information contained in said data 
flow with pre-specified values; 

a configurable classification rule engine for initiallv classifying said data flow into one of 
a plurality of traffic classes based on results of said comparisons between said rules and said pre- 
specified value s3_and subsequently reclassifvdnp said data flow into a different one of the phiralitv 
of traffic classes based r>r> Hiffia tent results of said comparisons: 

a configuration file for configuring said classification rule engine and for specifying said 
pre-specificd values and information regarding at least one of said data flow, said rule set, and 
said plurality of traffic classes, 

wherein said configuration file comprises a format that allows for the modification and 
reconfiguration of said classification rule engine, said data flow, said rule set, and said plurality 
of traffic classes. 

2. (original) The system of Claim 1, wherein, said data flow managing mechanism includes a flow 
table mechanism configured to perform at least one of capturing said information contained in 
said data flow, mapping a packet to a data flow, identifying said data flow based on said capmred 
infbnnation, registering active data flows, and deleting inactive data flows. 

3. (original) The system of Claim 2, wherein said plurality of roles comprise a data structure 
including, 

event indicia for indicating the invocation of one of said rules, condition indicia for 
representing a comparison or condition between said one of said rules and said pre-specified 
values, and 

action indicia for indicating the execution of an action based on results of 
said comparison. 
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4. (original) The system of Claim 3, wherein said action indicia includes information for at least 
one of designating said data flow as one of said traffic classes and chaining to another of said 
rules 

5. (original) The systexn of Claim 4, wherein said classification engine classifies said data flow 
into one of said traf&c classes in accordance with a dynamic classification scheme. 

6- (original) The system of Claim 5, wherein said data flow managing mechanism identifies said 
data flow as a particular type of traffic. 

1, (original) The system of Claim 6, further comprising a traffic monitoring mechanism 
configured to monitor attributes of said data flow and to provide update infbmiation to said data 
flow managing mechanism. 

8. (original) The system of Claim 7, wherein said traffic monitoring mechanism comprises a 
plurality of traffic monitors, each of said trafiic motriiors being capable of monitoring and 
measuring at least one predetermined attribute of said data flow. 

9- (original) The system of Claim 8, wherein said traffic monitors comprise a data structure 
including, 

identifier indicia for identifying a type of traffic monitor, and 
value indicia for indicating a value measxired by said traffic monitor. 

10. (original) The system of Claim 9, wherein classification engine comprises a data structure 
including, 

traffic type indicia indicating the traffic type of said data flow, 

traffic class indicia representing the different classes of traffic corresponding to the traffic 

type, 

transition indicia indicating transitions fioni one of said traffic classes to another of said 
traffic classes, and 
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rule indicia containing traffic nxoniior infonnation, corresponding rule infonnation, said 
predefined values> and transition class information, 

wherein said classification engine compares said traffic monitor information to said rule 
and said predefined values to classify said data flow into a traffic class corresponding to said 
traffic type, 

H. (original) The system of Claim 4, wherein said classification engine classifies said data flow 
into one of said traffic classes in accordance with a Layer-7 classification scheme. 

12. (origmal) The system of Claim 11, wherein $aid classification engine selects a predetermined 
packet from said data flow containing application informatiorL 

13. (original) The system of Claim 12, wherein said classification engine comprises a data 
stmcture including, 

information location indicia indicating the location where said application information is 
contained within said predetermined packet, 

character indicia defining the number of characters within said location indicia to be 
compared, and 

pattern indicia representing a pattern corresponding to a particular traffic class. 

14. (original) The system of Claim 13, wherein said classification engine compares said pattem 
indicia to said character indicia to classify said data fiow into said traffic class. 

15. (currently amended) A method of classifying a data How, comprising: 

identifying, tracking, and managing said data flow by a data flow managing mechanism; 

comparing information contained in said data flow with a plurality of rules containing 
pre-specified values, said plurality of rules included in a mle set; and 

initially c lassifying^ by a configurable classification mle engine, said data flow into one of 
a plurality of traffic classes bas^ on results of said comparisons between said rules and said pre- 
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specified values , and subseouentlv reolassifving said data flow into a different one of the plurality 
of traffic classes based on different results of said comparisons: 

wherein said classification rule engine is configured by a configuiation flle, said 
configuration file specifying said pre-specified values and information regarding at least one of 
said data flow, said rule set, and said plurality of traffic classes, and 

wherein said configuration file comprises a fomiat that allows for the modification and 
reconfiguration of said classification rule engine, said data flow, said rule set, and said plurality 
of trafBc classes. 

16, (original) The method of Claim 15, wherein said data flow managing mechanism includes a 
flow table mechanism configured to perform at least one of capturing said infonnation contained 
in said data flow, m^>ping a packet to a data flow, identifying said data flow based on said 
captured information, registering active data flows, and deleting inactive data flows. 

17- (original) The method of Claim 16, wherein said plurality of rules comprise a data 
structure including, 

event indicia for indicating the invocation of one of said rules, condition indicia for 
representing a comparison or condition between said one of said rules and said pre-specified 
values, and 

action indicia for indicating the execution of an action based on results of 
said comparison. 

1 8, (original) The method of Claim 17, wherein said action indicia includes infonnation for at 
least one of designating said data flow as one of said traffic classes and chaining to another of 
said rules. 

19. (original) The method of Claim 18, wherein said classification engine classifies said data 
flow into one of said traffic classes in accordance with a dynamic classification scheme. 
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20. (original) The method of Claim 19, wherein said data flow managing mechanism identifies 
said data flow as a particular type of traffic. 

21 . (original) The method of Claim 20, flmher comprising a traffic monitoring mechanism 
configured to monitor attributes of said data flow and to provide update information to said data 
flow managing mechanism. 

22. (original) The method of Claim 21, wherein said traffic monitoring mechanism comprises a 
plurality of traffic monitors, each of said traffic monitors being capable of monitoring and 
measuring at least one predetemiined attribute of said data flow. 

23. (original) The method of Claim 22, wherein said traffic monitors comprise a data structure 
including, 

identifier iadicia for identifying ai type of traffic monitor, and value indicia for indicating 
a value measured by said traffic monitor. 

24. (original) The method of Claim 23, wherein classification engine comprises a data structure 
including, 

traffic type indicia indicating the traffic type of said data flow, 

traffic class indicia representing the different classes of traffic corresponding to the traffic 

type, 

transition indicia indicating transitions from one of said traffic classes to another of said 
traffic classes, and 

rule indicia containing traffic monitor inforaiation, corresponding rule information, said 
predefined values, and transition class informatioiL, 

wherein said classification engine compares said traffic monitor information to said mle 
and said predefined values to classify said data flow into a traffic class corresponding to said 
traffic type. 
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25. (original) The method of Claim 18, wherein said classification engine classifies said data 
flow into one of said traffic classes in accordance with a Layer-7 classification scheme. 

26. (ori^al) The method of Claim 25, wherein said classification engine selects a 
predetOTnined packet fixnod said data flow containing application infonnation- 

27. (original) The method of Claim 26, wherein said classification engine comprises a data 
structure including, 

information location indicia indicating the location where said application information is 
contained within said predetennined packet^ 

character indicia defining the number of characters within said location indicia to be 
compared, and 

pattern indicia representing a pattern corresponding to a particular traffic class. 

28. (original) The method of Claim 27, wherein said classification engine compares said pattern 
indicia to said character indicia to classify said data flow into said traffic class, 

29* (original) A machine-readable medium encoded with a pluraUty of processor-executable 
instruction sequences for classifying a data flow, said instruction sequences comprising: 

identifying, tracking, and managing said data flow by a data flow managing mechanism; 

comparing information contained in said data flow with a pliirality of rules containing 
pre-specified values, said plurality of rules included in a rule set; and 

classifying, by a configurable classification rule engine, said data flow into one of a 
plurality of traffic classes based on results of said comparisons between said rules and said pre- 
specified values; 

wherein said classification rule engine is configured by a configuration file, said 
configuration file specifying said pr^specified values and infonnation regarding at least one of 
said data How, said rule set, and said plurality of traffic classes, and 
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wherein said configuration file comprises a format that allows for the modificatioD and 
reconfiguration of said classification rule engine, said data flow> said rule set, and said plurality 
of traffic classes. 

30. (original) The machine-readable medium of Claun 29, wherein said data flow managing 
mechanism includes a flow table mechanism configured to perform at least one of capturing said 
information contained in said data flow, mapping a packet to a data flow, identifying said data 
flow based on said captured information, registering active data flows, and deleting inactive data 
flows. 

31. (original) The machine-readable medium of Claim 30) wherein said plurality of rules 
comprise a data structure including, 

event indicia for indicating the invocation of one of said rules, condition indicia for 

representing a comparison or condition between said 

one of said rules and said pre^specified values, and 

action indicia ibr indicating the execution of an action based on results of 

said comparison. 

32. (original) The machine-readable medixun of Claim 31, wherein said action indicia includes 
infonnation for at least one of designating said data flow as one of said traf&c classes and 
chaining to another of said rules. 

33. (original) The machine-readable medium of Claim 32, wherein said classification engine 
classifies said data flow into one of said traffic classes in accordance with a dynamic 
classification scheme. 

34* (original) The machine-readable medium of Claim 33, wherein said data flow managing 
mechanism identifies said data flow as a particular type of traffic. 
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35, (origitial) The machine-readable mediiwn of Claim 34, further comprising a traffic monitoring 
mechanism configured to monitor attributes of said data flow and to provide update information 
to said data flow managing mechanism. 



36. (original) The machine-readable medium of Claim 35, wherein said traffic monitoring 
mechanism comprises a plurality of traffic monitors, each of said traffic monitors being capable 
of monitoring and measuring at least one predetermined attribute of said data flow. 

37. (original) The machine-readable medium of Claim 36, wherein said traffic monitors comprise 
a data structure including, 

identifier indicia for identifying a type of traffic monitor, and value indicia for indicating 
a value measured by said traffic monitor. 

38. (original) The machine-readable medium of Claim 37, wherein classification engine 
comprises a data structure including, 

traffic type indicia indicating the traffic type of said data flow, traffic class indicia 
representing the different classes of traffic corresponding to the traffic type, 

transition indicia indicating transitions &cm one of said traffic classes to another of said 
traffic classes, and 

rule indicia containing traffic monitor information, corresponding rule information, said 
predefined values, and transition class ioformation, 

wherein said classification engine compares said traffic monitor information to said rule 
and said predefined values to classify said data flow into a traffic class corresponding to said 
traffic type. 

39. (original) The machine-readable medium of Claim 32, wherein said classification engine 
classifies said data flow into one of said traffic classes in accordance with a Layer-7 classification 
scheme. 
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40. (original) The machine-readable medium of Claim 39, wherein said classification engine 
selects a predetermined packet fiom said data flow containing appHcation information. 

41. (original) The machine-readable medium of Claim 40, wherein said classification engine 
comprises a data structure including, 

information location indicia indicating the location where said application information is 
contained within said predetemiined packet, 

character indicia defining the number of characters within said location indicia to be 
compared, and 

pattern indicia representing a pattern corresponding to a particular traffic class. 
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